A critical confused-deputy flaw in Red Hat Advanced Cluster Management's multicloud-operators-subscription component lets a namespace-admin tenant escalate to cluster-wide control, rated CVSS 9.9.
What Is It
CVE-2026-72508 is a flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes (RHACM). A tenant holding namespace-admin rights can create Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount. Because the subscription controller acts on the tenant's behalf with that elevated identity, the tenant can deploy arbitrary cluster-scoped resources; a textbook confused-deputy attack.
Red Hat classifies the weakness as CWE-250 (Execution with Unnecessary Privileges). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base score 9.9, CRITICAL. The scope-changed flag is what pushes this near the ceiling: the attack starts inside one namespace's security boundary and lands outside it.
Why It Matters
The prerequisite is low; network reach and a low-privilege account, no user interaction. The outcome is high across confidentiality, integrity, and availability: privilege escalation and potential arbitrary code execution across the cluster.
For multi-tenant RHACM deployments, this collapses the namespace isolation model that tenancy depends on. Any party trusted with admin rights in a single namespace, an internal team, a customer, a compromised CI identity, becomes an effective cluster admin.
What's Vulnerable
- Product: Red Hat Advanced Cluster Management for Kubernetes 2 (
cpe:/a:redhat:acm:2) - Package:
rhacm2/multicluster-operators-subscription-rhel9 - Default status: affected
No narrower version boundaries are specified in the supplied record; the default status is "affected" for the RHACM 2 stream.
Patch Status
The supplied record lists no fix version, patch commit, or mitigation guidance.
Consult the Red Hat CVE page and Bugzilla entry below for current errata and remediation state; those are the authoritative sources for fixed package builds.
Sources
- Red Hat Security; CVE-2026-72508: https://access.redhat.com/security/cve/CVE-2026-72508
- Red Hat Bugzilla; Bug 2514225: https://bugzilla.redhat.com/show_bug.cgi?id=2514225